Task 2: Managing Linux Bridge Bridging is "plugging" one or more network interfaces into another network interface which has the connectivity to a larger network. Imagine your dorm only has a limited number of ethernet ports. You and your roommate can bridge your computers to a single ethernet port to join the Internet. The job of the bridge is to examine the data packet destination and decide where should it be passed to, or whether should drop the packet, by looking at the MAC address of plugged network interfaces. Linux bridge is a software bridge which emulates the behavior of a hardware bridge and provides additional powerful features like firewalling. You can check if your system (lb-vm1) has the bridge kernel module by the following command: S modinfo bridge filename alias version license srcversion depends: intree: vermagic: lib/modules/4.4.0-97-generic/kernelet/bridge/bridge.ko rtnl-link-bridge 2.3 GPL E093FB4EB1EE49C1B0F6A2F 4.4.0-97-generic SMP mod unload modversions If it shows no errors, you can manage bridges either using the brctl command in the bridge-utilities package or the ip command. We will be using brctl in the rest of the instructions. First, let's see all subcommands brctl offers. $ brctl Usage: brctl [commands] commands addbr add bridge delbr addif add interface to bridge delif delete interface from bridge hairpin port fonloff turn hairpin on/off setageing set bridge priority setfd time set hello time setmaxage setpathcost set port priority show bridge>show a list of bridges showmacs showstp onloff turn stp on/off delete bridge set max message age show a list of mac addrs show bridge stp info To create a bridge, you can use the addbr subcommand followed by the bridge name: S sudo brctl addbr br0 The above command will add a bridge named br0. The bridge will show as a network interface, and you can check it by command ifconfig br0, or you can show all the bridges using S brctl show bridge name bridge id br0 STP enabled interfaces 8000.000000000000 no Deleting a bridge is just as simple as creating a bridge. You can use brctl delbr with the bridge name S sudo brctl delbr br0 Now, let us try to plug an interface into the bridge (on lb-vm1). Please be careful with the interface name when you enter the command. Add an interface to a bridge will make the interface lose network connection temporarily, and the first Ethernet interface, which is ens3, is the channel for the VM to communicate with you. Make sure you do not operate on the ens3 interface, or you will lose the connection to your VM. Enter the following command to add the second Ethernet interface ens4 to bridge br0 $ sudo brctl addif br0 ens4 You can check the bridge detail once again using brctl show. Also, if you want to remove an interface from a bridge, you can run the following command $ sudo brctl delif br0 ens4 After you add the interface to the bridge, we may test the interface connectivity to its subnet by pinging the other VM (Ib-vm2) S ping -I ens4 10.0.0.12 c 3 PING 10.0.0.1 (10.0.0.1) from 10.0.0.10 ens4: 56(84) bytes of data From 10.0.0.10 icmp seq-1 Destination Host Unreachable rom 10.0.0.10 icmp_seq 2 Destination Host Unreachable From 10.0.0.10 icmp seq-3 Destination Host Unreachable 10.0.0. l ping statistics 3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2014ms pipe 3 At this time, you should receive "Destination Host Unreachable" error, which means ens4 cannot send or receive packets from other hosts on the same subnet. This can be explained with the first two sub-figures (1 and 2) in Figure 5. Subnet 0.0.0.0/16 lb-vm1 bro ens4 System lb-vm2 Subnet 0.0.0.0/16 lb-vm1 bro ens4 System lb-vm2 2 Subnet 10.0.0.0/16 lb-vm1 bro ens4 System Ib-vm2 3 Figure 5 Steps of connecting a virtual host to the Linux bridge At first, the system connects to the subnet via ens4 directly. When we add ens4 to the bridge, we cut down the connection between the system and ens4 The system still tries to send packets to ens4 instead of br0. To re-establish the connection, we need to instruct the system to send all traffic within the subnet to br0. To do this, we need to move the IP address of ens4 to br0 and bring up the bridge interface. $ sudo ip addr del 10.0.0.10/16 dev ens4 S sudo ip addr add 10.0.0.10/16 dev br0 $ sudo ip link set br0 up Now, you should be able to ping other hosts in the subnet. Let us try to add a few more interfaces to the bridge and see whether it works. Run the following command to add two virtual hosts hl and h2 to your VM Ib-vm1. $/start.sh Virtual Hosts Activated Type exit to quit You can use " " to execute network-related commands as if they are executed in another machine. No sudo is needed here. For example, you can list interfaces of hl using S hl ifconfig -a Or ping another host using S h2 ping 10.0.0.12 -c 3 Also, you can still execute commands in the host VM by simply type commands without host name. If you list interfaces on the host VM, you will find there are two new interfaces added, which are p-hl and p-h2. Each of the p-* interfaces are one end of a tunnel which connects the virtual host and the VM. Packets from the virtual hosts can reach the VM through this tunnel, and so is the other way around. Figure 6 depicts the current network topology. To connect hi to the subnet, we need to add the VM side p-hl to the bridge. $ sudo brctl addif br0 p-hl This will connect p-hl to the bridge brO, and also make it possible for virtual host hl to communicate with other hosts in the subnet. Remember to use the exit command once you are done with tinkering the virtual hosts. Subnet 0.0.0.0/16 lb-vm1 ens4 eth1 eth1 h1 h2 lb-vm2 Figure 6 Network structure of the host VM and virtual hosts LAB EXERCISE 2 You are expected to activate the two virtual hosts using the /home/ubuntu/start.sh script on lb-vm1 and to connect both hosts to the internal network 10.0.0.0/16. Answer the following questions 1. What is the MAC address of the bridge interface? 2. What commands do you use to connect the virtual hosts to the network? What are the IP and MAC addresses of the virtual hosts? 3. Open Wireshark on the second VM (lb-vm2) and listen on the ens3 interface. Then, ping it from virtual host hl. What are the IP and MAC addresses of the incoming packets you see in Wireshark? What does this mean? 4. On the first VM (Ib-vm1), use tcpdump to capture traffic on ens4. Ping the second VM (lb-vm2) and h2 from hl successively. What commands do you use? What do you observe and what does it mean